A vulnerable function in Hashflow's contract allowed attackers to trigger transferFrom() on approved user tokens. The attacker exploited an approve-related issue across five chains, draining approximately $605K. The white-hat nature of the attack was later confirmed, and a recovery function was provided by the attacker, with Hashflow committing to compensating all affected users.

Decentralized trading platform Hashflow is suspected to have suffered an authorization-related attack, though this may be a white-hat hacking operation. The loss from the theft was approximately $600,000, and all affected users were able to retrieve all of their assets.